Overview on S-Box Design Principles Debdeep Mukhopadhyay Assistant - - PDF document

overview on s box design principles
SMART_READER_LITE
LIVE PREVIEW

Overview on S-Box Design Principles Debdeep Mukhopadhyay Assistant - - PDF document

Overview on S-Box Design Principles Debdeep Mukhopadhyay Assistant Professor Department of Computer Science and Engineering Indian Institute of Technology Kharagpur INDIA -721302 What is an S-Box? S-Boxes are Boolean mappings from {0,1}


slide-1
SLIDE 1
  • D. Mukhopadhyay Crypto & Network

Security IIT Kharagpur 1

Overview on S-Box Design Principles

Debdeep Mukhopadhyay Assistant Professor Department of Computer Science and Engineering Indian Institute of Technology Kharagpur INDIA -721302

What is an S-Box?

  • S-Boxes are Boolean mappings from

{0,1}m{0,1}n

– m x n mappings

  • Thus there are n component

functions each being a map from m bits to 1 bit

– in other words, each component function is a Boolean function in m Boolean variables

slide-2
SLIDE 2
  • D. Mukhopadhyay Crypto & Network

Security IIT Kharagpur 2

Boolean Function

  • A Boolean function is a mapping

from {0,1}m{0,1}

  • A Boolean function on n-inputs can be represented in

minimal sum (XOR +) of products (AND .) form:

  • The ANF form is canonical…
  • If the and terms have all zero co-efficients we have an affine

function

  • If the constant term is further 0, we have a linear function

f(x1,…,xn)= a0+ a1. x1 + …+ an. xn+ a1,2.x1.x2+ …+ an-1,n.xn-1.xn+ … …+ a1,2,..,n x1.x2 ...xn

Boolean Function

  • A Boolean function is a mapping from

{0,1}m{0,1}

  • Sequence of a Boolean Function:

1 2 1

: {0,1} be a Boolean Function. Binary sequence ( ( ), ( ),..., ( )) is called the Truth Table of

n

n

f f f f f α α α

Σ →

1 2 1

( ) ( ) ( )

{( 1) ,( 1) ,...,( 1) } is called sequence of

n

f f f

f

α α α

− − −

slide-3
SLIDE 3
  • D. Mukhopadhyay Crypto & Network

Security IIT Kharagpur 3

Balanced Function

  • A Boolean function is said to be

balanced if its truth table has equal number of ones and zeros.

  • The Hamming weight of a binary

sequence is the number of ones

Scalar Product of Sequences

  • Consider f and g as two Boolean functions.
  • Consider, η be the sequence of f and ε be the

sequence of g.

  • Define,

, (#no of cases when f=g)-(#no of cases when f g) η ε < >= ≠

slide-4
SLIDE 4
  • D. Mukhopadhyay Crypto & Network

Security IIT Kharagpur 4

Non-linearity

  • The non-linearity of a Boolean function

can be defined as the distance between the function and the set of all affine functions.

n

m in ( , ) w here is the set of all affine functions over

n

f g n

N d f g A

∈ Α

∴ = Σ

1

1 1 0,1,...,2

1 ( , ) 2 , 2 1 2 max {| , |}, 2 where is the sequence of a linear function in

n

n n f i i i

d f g N l l x η ε η

− − =

= − < > ∴ = −

A Compact Representation of all the linear functions

  • Hadamard Matrix: Any rxr matrix with elements in {-1,1} if

HHT=rIr, where Ir is the identity matrix of dimension rxr.

  • Walsh Hadamard Matrix:
  • Each row of Hn is the sequence of a linear function in x

belonging to {0,1}n

  • Each row, li is the sequence of the Boolean function,

1 1 1 1 1

1, , 1,2,...

n n n n

H H H H n H H

− − − −

⎡ ⎤ = = = ⎢ ⎥ − ⎣ ⎦

( ) , , is the binary representation of Note that and are not sequences, but they are binary tuples of length

i i i

g x x i x n α α α =< >

slide-5
SLIDE 5
  • D. Mukhopadhyay Crypto & Network

Security IIT Kharagpur 5

Effect of Input Transformation

  • n balanced-ness and Non-linearity
  • If a Boolean function, f(x) is

balanced, then so is g=f(xB ^ A), A is an n-bit vector and B is an nxn 0-1 invertible matrix

  • Non-linearity of f and g are same.

Strict Avalanche Criteria

  • Informally, if one bit input is changed in an S-

Box, then half of the output bits should be changed

  • For a function, f to satisfy SAC the following

condition is satisfied:

  • Higher order SAC, when more than one input

bits change

  • Both the SAC and the higher order SAC

together make Propagation Criteria (PC)

( ) ( ) is balanced, where wt( )=1 f x f x α α ⊕ ⊕

slide-6
SLIDE 6
  • D. Mukhopadhyay Crypto & Network

Security IIT Kharagpur 6

How to make a Boolean Function satisfy SAC?

  • Consider a Boolean function, f(x)
  • Consider a non-singular {0,1} matrix of

dimension nxn.

  • If for each row of the matrix A if:

then g(x)=f(xA) satisfies the SAC.

( ) ( ) is balanced, is a row of the matrix A f x f x γ γ ⊕ ⊕

Example

  • f(x)=x1x2 ^ x3 does not satisfy SAC?
  • Why? Consider α=(001)
  • f(x)^f(x^e1) is balanced, e1=(100)
  • f(x)^f(x^e2) is balanced, e2=(010)
  • f(x)^f(x^e3) is balanced, e3=(111)
  • Check that g(x)=f(xA) satisfies SAC

1 A= 0 1 1 1 1 ⎡ ⎤ ⎢ ⎥ ⎢ ⎥ ⎢ ⎥ ⎣ ⎦

slide-7
SLIDE 7
  • D. Mukhopadhyay Crypto & Network

Security IIT Kharagpur 7

Bent Functions

  • Non-linearity of Boolean functions have

an upper bound

  • Functions which achieve this are called

Bent functions

  • They satisfy PC for all α
  • But they are always unbalanced
  • Bent functions exist for even values of

n

1 1 2

2 2

n n f

N

− −

≤ −

Example

  • f(x)=x1x2 ^ x3x4 is a Bent function in

4 variables

  • If f is a Bent function

– so is f ^ (affine function) – f(xA ^ B) for a non-singular binary matrix A is also Bent

  • Bent functions are not balanced.

Number of zeros, is 2n-1±2n/2-1

slide-8
SLIDE 8
  • D. Mukhopadhyay Crypto & Network

Security IIT Kharagpur 8

Creating Balanced Non-linear function

  • Take 2n-k, k-variable linear function,

where k>n/2

  • Concatenate the truth-tables
  • Thus, we obtain a nxk mapping

which is non-linear

– Nf≥2n-1-2k-1

  • Balanced
  • Can be made to satisfy SAC.

Is the S-Box good against LC and DC?

  • Not only the component functions

are good:

– high non-linearity – satisfy PC – etc.

  • but their non-zero linear

combinations also have to satisfy.

– Challenging problem

slide-9
SLIDE 9
  • D. Mukhopadhyay Crypto & Network

Security IIT Kharagpur 9

Design of S-Box is even more complex

  • Good S-Boxes from the cryptographic

point of view when put in hardware are found to leak information, like power consumption etc

  • They thus lead to attacks called Side

Channel Attacks, which can break ciphers in minutes…after all the hard-work

  • Then there are Algebraic Attacks…
  • So, what to do? Open Research

Problem(s)…

Criteria of Good S-Box

  • Balanced Component functions
  • Non-linearity of Component

functions high

  • Non-zero linear combinations of

Component functions balanced and highly non-linear

  • Satisfies SAC
  • High Algebraic degree
slide-10
SLIDE 10
  • D. Mukhopadhyay Crypto & Network

Security IIT Kharagpur 10

Exercise

  • Enumerate 8 distinct linear functions in 5

variables, x1, x2, x3, x4, x5

  • Concatenate their Truth-tables to obtain

an 8 input, 5 output function.

  • Store the resultant mapping as a 8x5 S-

Box.

  • What is the non-linearity of your SBox?
  • Does is satisfy SAC? If not, modify the

function to do so.

Further Reading

  • J. Seberry, Zhang, Zhang, “Cryptographic

Boolean Functions via Group Hadamard Matrices”, AJC Journal of Combinatorics, vol 10, 1994

  • K. Nyberg, “Differentially Uniform

Mappings for Cryptography”, Eurocrypt 1993

  • K. Nyberg, “Perfect Non-linear SBoxes”,

Eurocrypt 1991

slide-11
SLIDE 11
  • D. Mukhopadhyay Crypto & Network

Security IIT Kharagpur 11

Next Days Topic

  • Modes of operation of Block Ciphers